Privacy Policy
This is an upcoming version of this document (effective 2026-12-01).
Effective Date: December 1, 2026
TmaxTibero Co., Ltd. (the “Company”) complies with the Personal Information Protection Act of Korea and other applicable laws to protect the freedom and rights of data subjects, and lawfully processes and securely manages personal information. Accordingly, pursuant to Article 30 of the Personal Information Protection Act, the Company establishes and discloses this Privacy Policy to inform data subjects of the procedures and standards for processing personal information and to handle related complaints promptly and smoothly.
This Privacy Policy applies to the OwlAI cloud service and its web interface, desktop app, and mobile app (the “Service”). If you use the desktop or mobile app to connect to an OwlAI server installed and operated by an organization other than the Company, the personal information processed on that server is governed by that organization’s privacy policy.
Key Personal Information Processing Summary
| Category | Details |
|---|---|
| Items processed | Email, conversations, documents and meeting audio, access records |
| Purposes | Member management, provision of the Service, billing, marketing (if you consent) |
| Retention period | Until account deletion (conversations: 1 year from last use; meeting audio: destroyed as soon as the meeting ends) |
| Outsourcing and international transfer | Amazon Web Services (Republic of Korea), OpenAI, AssemblyAI, Cohere, Tavily, Google, AWS Marketplace |
| Provision to third parties | None |
| Complaints | Chief Privacy Officer, security@tibero.com |
※ See the body of this Privacy Policy below for details.
1. Purposes of Processing Personal Information
The Company processes personal information for the following purposes. Personal information is not used for purposes other than those below, and if the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.
- Member registration and management: confirming your intent to register, identification and authentication, verifying that you are of legal age, account protection (such as two-step verification), preventing misuse of the Service, and sending notices
- Provision of the Service: question answering using generative AI, document storage and search, database connections, meeting transcription and minutes, workflow automation, connections to external services, management of organizations and members, and task completion notifications
- Billing: subscription verification, usage metering and billing, and preventing duplicate free trials
- Service operation and improvement: incident response, security audits, improving answer quality (limited to answers rated by users), and usage statistics
- Handling complaints: reviewing and responding to inquiries, and handling disputes
- Marketing (if you consent): advertising information about new features, events, discounts, and the like
2. Personal Information Items Processed
(1) The Company processes the following personal information without the data subject’s consent pursuant to Article 15(1)4 of the Personal Information Protection Act (conclusion and performance of a contract).
| Category | Items |
|---|---|
| Registration and account | Email address, display name (optional), password (encrypted so that it cannot be restored), time zone, display language, time of legal-age confirmation, records of consent to the terms (version, items, time), status of consent to receive advertising information and the time it was changed or confirmed, two-step verification information, organization and role |
| Information you enter or upload | Questions and conversation content, attachments and uploaded documents, meeting audio and its transcripts and minutes, voice input, saved memories, workflow automation settings and results, answer ratings, connection information for external services and databases (access information and credentials are encrypted) |
| Information generated or collected automatically | IP address, browser and device information (User-Agent), access time, login success and failure records, service usage and error records, AI usage |
| If you turn on notifications | Browser notification subscription information (notification endpoint and encryption keys), mobile app notification device token (Firebase Cloud Messaging) and device type, time last confirmed |
| Paid services | AWS account identifier, subscription and contract information, number of seats and usage, whether a free trial was received (an irreversibly transformed value of the email address and the email domain). Payment method information such as card numbers is processed by Amazon Web Services, and the Company does not receive it. |
| Organization invitations | Email address of the invitee (entered by the organization administrator) |
(2) The Company processes the following personal information with the data subject’s consent pursuant to Article 15(1)1 of the Personal Information Protection Act (consent). Not consenting does not limit your use of the Service.
- Receiving advertising information (optional): email address — until consent is withdrawn or the account is deleted
(3) The Company collects personal information through the sign-up screen, Service screens, and inquiry emails, and automatically collects information generated while you use the Service.
(4) The Company does not collect sensitive information or unique identification information, and does not process pseudonymized information or personal information of children under 14. Users must take care not to include other people’s personal information or sensitive information in questions or attachments, and must inform participants before recording a meeting.
3. Processing and Retention Period of Personal Information
(1) The processing and retention period for each type of personal information is as follows.
| Personal information | Retention period |
|---|---|
| Account information | Until account deletion. On deletion, the email address is destroyed immediately and other personal data within 30 days. |
| Conversations (questions, answers, list of attachments) | 1 year from last use. Destroyed 30 days after deletion; attachments are destroyed immediately upon deletion |
| Files created in conversations | 7 days from creation |
| Answer ratings and the conversations sent with them | 90 days from the rating |
| Meeting audio | Destroyed as soon as meeting recording ends. Paused meetings not resumed for 7 days are ended and destroyed automatically |
| Meeting records (transcripts, minutes), uploaded documents, memories | Until you delete them or your organization is terminated |
| Task automation run records | The most recent 100 runs per automation |
| Service operation records (AI calls, processing steps, job history, application logs) | Up to 90 days |
| Access and administration records (logins, permission changes, viewing by administrators and operators) | 3 years (for security audits) |
| Notification subscriptions and app notification devices | Immediately when you turn off notifications or log out; destroyed automatically if not confirmed for 60 days |
| Sign-up verification and password reset records (email, request IP) | 7 days from use or expiry |
| Organization invitations | 30 days from acceptance, cancellation, or expiry |
| AI usage records | Until you delete your account or your organization is terminated. After that, items that can identify users are removed and the records are kept only as statistics |
| AWS Marketplace sign-up linking records (IP, AWS account identifier) | 7 days from completion of linking |
| Free trial records | While the Service is provided. The email address is kept only as an irreversibly transformed value and used only to prevent duplicate free trials |
(2) When an organization’s subscription ends or the organization is terminated, its data is destroyed 30 days after that date. Deleted information is removed from disaster recovery backups within 30 days for files and 7 days for databases.
(3) Personal information retained under applicable laws is as follows.
- Records on contracts or withdrawal of subscriptions: 5 years (Article 6(1)2 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce)
- Records on payment and supply of goods: 5 years (Article 6(1)3 of the same Decree)
- Records on consumer complaints or dispute resolution: 3 years (Article 6(1)4 of the same Decree)
- Computer communication and internet log records and access location tracking data: 3 months (Article 15-2(2) of the Protection of Communications Secrets Act)
4. Procedures and Methods for Destroying Personal Information
(1) The Company destroys personal information without delay when it is no longer needed, such as when the retention period has expired or the purpose of processing has been achieved. Personal information that must be retained under other laws is moved to a separate database (DB) or stored in a separate location.
(2) The Company destroys personal information whose retention period has expired automatically every day, and destroys personal information recorded and stored as electronic files so that the records cannot be reproduced. The Company does not keep personal information in paper documents.
5. Provision of Personal Information to Third Parties
The Company does not provide data subjects’ personal information to third parties, except where the data subject has given separate consent or where there are special provisions in law.
6. Outsourcing of Personal Information Processing
(1) The Company outsources personal information processing as follows for smooth handling of personal information.
| Entrusted party (processor) | Outsourced tasks | Processing location |
|---|---|---|
| Amazon Web Services, Inc. | Service operation infrastructure (servers, databases, file storage, log retention), embedding processing for document search (Amazon Bedrock), email delivery (Amazon SES) | Republic of Korea (Seoul Region) |
(2) When concluding an outsourcing contract, the Company specifies in writing, pursuant to Article 26 of the Personal Information Protection Act, matters including the prohibition of processing personal information for purposes other than the outsourced tasks, restrictions on re-outsourcing, and liability such as compensation for damages, and supervises whether the processor handles personal information securely.
7. International Transfer of Personal Information
(1) The Company transfers personal information collected from Service users overseas as described below, and provides the following information pursuant to Article 28-8(2) of the Personal Information Protection Act. The legal basis for the international transfer is Article 28-8(1)3 of the same Act (outsourcing and storage overseas for the performance of a contract), and all transfers are made by network transmission over encrypted communication (TLS).
| Recipient (contact) | Country | Personal information transferred | Purpose | Time and method of transfer | Retention and use period |
|---|---|---|---|---|---|
| OpenAI, L.L.C. (privacy@openai.com) | United States | Questions and conversation content, content extracted from attachments and documents, voice input | Generating AI answers, transcribing voice input | Network transmission on each request | Requested not to store responses. However, the provider retains data for up to 30 days for abuse monitoring and then deletes it, and does not use it for model training |
| AssemblyAI, Inc. (https://www.assemblyai.com/legal/privacy-policy) | Ireland (EU region) | Meeting audio | Meeting transcription | Sent segment by segment while the meeting is recorded | Deletion requested immediately after transcription, deleted again within 24 hours if that fails, excluded from training |
| Cohere Inc. (privacy@cohere.com) | Canada | Search queries, excerpts of candidate documents | Reranking document search results | Sent each time documents are searched | Deleted after up to 30 days, configured not to be used for model training |
| AlphaAI Technologies Inc. (Tavily) (https://www.tavily.com/privacy) | United States | Web search terms, web addresses to read | Web search | Sent each time the web is searched | Configured not to store search data or use it to improve its services |
| Google LLC (Firebase Cloud Messaging) (googlekrsupport@google.com) | United States | Mobile app notification device token, notification text (fixed text such as “Your chat response is ready”), identifier of the screen to open | Delivering mobile app notifications | Sent each time a notification occurs (if app notifications are on) | Subject to the provider’s policy after delivery. Conversation content is not sent |
| Amazon Web Services, Inc. (AWS Marketplace) (aws-korea-privacy@amazon.com) | United States | AWS account identifier, subscription information, number of seats and usage | Subscription verification, usage billing | When linking a subscription and reporting usage | Subject to the provider’s billing and accounting policies |
(2) Data subjects may refuse the international transfer by emailing the Chief Privacy Officer. However, AI answers, meeting transcription, reranking of document search results, and web search cannot be provided without the international transfer, so if you refuse, you cannot use those features; if you do not want the international transfer, you may delete your account. Mobile app notifications are not transferred if you turn them off in the app settings.
(3) Information sent to external services connected directly by the organization (MCP servers, external databases) and to browser notification services is sent at the user’s choice, and its processing is governed by the policies of those providers.
8. Measures to Ensure the Security of Personal Information
The Company takes the following measures to ensure the security of personal information.
- Administrative measures: establishing and implementing an internal management plan, minimizing personnel who handle personal information, and regular staff training
- Technical measures: managing access rights to personal information processing systems, one-way encryption of passwords, encryption of credentials using a key management service (AWS KMS), encryption of stored data and data in transit, two-step verification, limits on failed logins, and retention of access records and prevention of their forgery or alteration
- Physical measures: storage in cloud data centers with controlled access
9. Installation, Operation, and Refusal of Automatic Collection Devices
(1) The Company does not use cookies for advertising or behavioral analysis. To keep you logged in, the Company stores authentication information in browser and app storage, and temporarily uses security cookies when connecting external services. If you refuse these, you cannot log in or connect external services.
(2) The mobile app uses the following access permissions, all of which are optional. You can use the remaining features without granting them, and you can change them at any time in your phone settings.
- Microphone: meeting recording and voice input
- Notifications: task completion notifications, and the “Recording” indicator that keeps recording going while the screen is off
10. Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them
(1) Data subjects may at any time request the Company to provide access to, correct, delete, or suspend processing of personal information, or withdraw consent (“exercise of rights”).
(2) You may exercise your rights through the Service screens or by email (support-owlai@tibero.com), and the Company will take action without delay.
- You can view, edit, and delete account information, conversations, documents, and memories directly on the Service screens.
- You can delete your account in “Settings › General › Delete account” (in the mobile app, “Me › Delete account”); deletion takes effect immediately and cannot be undone. If you cannot log in, you can request deletion from your registered email address to support-owlai@tibero.com (guide: https://owlai.cloud/account-deletion/).
- You can withdraw consent to receive advertising information in “Settings › General › Notifications” (in the mobile app, “Me › Notifications”) or through the “Unsubscribe” link in emails you receive.
- You can request a copy of your conversations and data at support-owlai@tibero.com.
(3) You may also exercise your rights through an agent, such as your legal representative or a person you have authorized. In this case, you must submit a power of attorney.
(4) The Company verifies whether the person exercising the rights is the data subject or a legitimate agent, and will respond within 10 days of receiving the request. If the Company refuses a request under applicable law, it will inform you of the reason.
(5) Requests concerning organization data, such as documents uploaded to the organization and organization settings, may be handled by the Company together with the organization administrator.
11. AI Services and Automated Decisions
(1) The Service processes your questions and materials with generative AI models provided by the providers in “7. International Transfer of Personal Information” to create answers and files. Neither the Company nor those providers use your content to train AI models.
(2) If you rate an answer or a run result, the organization administrator can view the full conversation (or run result or meeting minutes), and Company operators can also view it to improve answer quality. The Company informs you of this on screen before you rate, and operators’ viewing is recorded in the organization’s access records.
(3) If the Company needs to access the database directly to investigate an incident or handle an inquiry, it notifies the organization in advance and keeps a record of the access for 3 years.
(4) The Company does not make automated decisions under Article 37-2 of the Personal Information Protection Act.
12. Chief Privacy Officer
The Company has designated the following Chief Privacy Officer to take overall responsibility for personal information processing and to handle data subjects’ complaints and remedies for damage related to personal information processing.
- Chief Privacy Officer: Lee Seong-rim (Legal Compliance Team, Global Chief Privacy Officer) · +82-31-8018-1749 · security@tibero.com
- Service inquiries: support-owlai@tibero.com
13. Remedies for Infringement of Rights
Data subjects may apply to the following organizations for dispute resolution or consultation to obtain remedies for infringement of personal information.
- Personal Information Dispute Mediation Committee: 1833-6972 (without area code) (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (without area code) (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office: 1301 (without area code) (www.spo.go.kr)
- Korean National Police Agency: 182 (without area code) (ecrm.police.go.kr)
14. Changes to This Privacy Policy
(1) This Privacy Policy takes effect on December 1, 2026.
(2) If the Company changes this Privacy Policy, it will post a notice on the Service screens at least 7 days before the effective date, or at least 30 days before the effective date for changes material to data subjects’ rights, such as changes to the items collected, purposes of use, or international transfers.
(3) Previous versions of this Privacy Policy are available at https://owlai.cloud/legal/en/privacy/.
This Privacy Policy is provided in Korean and English. If there is any discrepancy between the two, the Korean version prevails.